Worked example · 2025-05

Inferno Drainer "Reloaded" — encrypted on-chain config + single-use smart contracts + fake CollabLand Discord phishing — multi-chain — September 2024 to March 2025 (Check Point disclosure 2025-05)

Loss: approximately $9M extracted across more than 30,000 unique victim wallets across 30+ blockchains over the September 2024 to March 2025 reporting window per Check Point Research's "Inferno Drainer Reloaded" disclosure (published 2025-05). Largest single-victim loss reported by Check Point: $761,000 in one transaction. The campaign is structurally distinct from the pre-November-2023 Inferno operation in that the per-victim contract is a single-use smart contract deployed per-affiliate per-campaign rather than a shared spender-cluster reused across campaigns; the laundering / aggregation rails route through proxy-obfuscated command-and-control rather than direct fee-collection-address aggregation as in the pre-shutdown era.
OAK Techniques observed: OAK-T6 (Defense Evasion) — primary frame for this writeup, distinct from the operator-cohort frame of examples/2024-10-inferno-drainer-handover.md. The Reloaded campaign exhibits three discrete defense-evasion overlays that are structurally novel relative to the pre-shutdown Inferno operation: (a) encrypted on-chain configuration — the drainer's command-and-control server addresses and per-campaign configuration parameters are stored in encrypted form on-chain, decryptable only by the drainer client at runtime, defeating standard on-chain-spender-blocklist enumeration; (b) single-use smart contracts — each victim is targeted via a freshly-deployed-per-victim smart contract rather than a shared spender, defeating spender-address-blocklist propagation across victims; (c) proxy-based C2 obfuscation — communication with command-and-control servers routes through proxy systems, defeating direct C2-address attribution. OAK-T4.001 (Permit2 Authority Misuse) and OAK-T4.005 (setApprovalForAll-NFT Drainer) chain as the underlying extraction primitives. OAK-T4.008 (Fake DEX-Clone / Front-End Phishing) applied to the Discord-bot impersonation flow: the campaign's primary distribution surface is impersonation of Collab.Land — the widely-used legitimate Discord verification-bot used by most major Web3 communities — to redirect Discord-server members onto phishing sites hosting the drainer payload. OAK-T8.001 / OAK-T8.002 at the service-infrastructure level: critical smart contracts deployed on 2023-09-09 (i.e., during the pre-shutdown Inferno-branded operation window) are still in use in the 2024-2025 Reloaded campaign per Check Point's blockchain analysis, demonstrating service-infrastructure persistence across the November 2023 brand-shutdown event consistent with the broader OAK-G02 framing.
Attribution: unattributed Check Point Research is the primary forensic provider for the Reloaded disclosure (2025-05); their analysis traces the malicious smart contracts, decrypts the on-chain encrypted drainer configurations, and fully uncovers the Discord phishing flow via the fake CollabLand bot. Multiple independent outlets (Decrypt, Infosecurity Magazine, GBHackers, Cybersecuritynews, FullyCrypto, Wizcase, NCNOnline) published convergent reporting in May 2025 within days of the Check Point disclosure. Check Point's blockchain analysis explicitly links smart contracts deployed 2023-09-09 (during the pre-shutdown Inferno-branded operation) to the 2024-2025 Reloaded campaign, supporting the OAK-G02 service-infrastructure-persistence framing. Per-affiliate / per-operator attribution is not public at v0.1 cutoff; the operator network is consistent with the broader OAK-G02 drainer-services-as-a-service category.
OAK-G02: the Reloaded campaign is the canonical 2025 worked example for the OAK-G02 service-infrastructure-persistence framing. Per [checkpointinfernoreloaded2025] and Decrypt / Infosecurity coverage, the smart contracts deployed during the pre-shutdown Inferno-branded operation in September 2023 remain operational in the Reloaded campaign 18+ months after the November 2023 Telegram-announced shutdown. This is direct on-chain corroboration of the actors/OAK-G02-drainer-services.md thesis that service-infrastructure persistence is a stronger attribution signal than operator-name persistence in the drainer-services category. See also examples/2024-10-inferno-drainer-handover.md for the operator-handover service-level framing covering the November 2023 shutdown event itself.
Key teaching point: The Inferno Drainer Reloaded campaign is the canonical 2025 worked example for commercial-drainer-service defense-evasion re-architecture at infrastructure-persistence scale. The case complements examples/2024-10-inferno-drainer-handover.md (operator-handover service-level frame) by anchoring the post-handover evasion-overlay re-architecture with named-disclosure-date, named-forensic-provider attribution at v0.1.

Summary

In November 2023, the Inferno Drainer service announced a Telegram-side shutdown of its branded operation (covered in examples/2024-10-inferno-drainer-handover.md). In May 2025, Check Point Research published "Return of the Crypto Inferno Drainer — Deep Dive into the Return of the Most Sophisticated Crypto Drainer" — a forensic analysis documenting that Inferno Drainer's underlying smart-contract infrastructure had not been retired in November 2023, and that a campaign re-using critical smart contracts deployed in September 2023 had stolen approximately $9M from more than 30,000 unique victim wallets across 30+ blockchains between September 2024 and March 2025.

The Reloaded campaign is structurally distinct from the pre-shutdown Inferno operation along three load-bearing defense-evasion axes that warrant explicit T6 framing:

1. Encrypted on-chain configuration. Pre-shutdown Inferno relied on standard on-chain spender-address clusters that defenders could enumerate and propagate to wallet-vendor warning lists. Reloaded stores the drainer's command-and-control server addresses and per-campaign configuration parameters in encrypted form on-chain — the configuration is publicly visible at the byte level but is encrypted and only decryptable by the drainer client at runtime. This defeats the previous defender-side enumeration approach of "scrape on-chain spender clusters and propagate to wallet warning lists" because the C2 endpoints are not on-chain in plaintext form. Check Point's analysis includes the decryption methodology, but the defender-side scraping pipeline must be updated to recognise and decrypt the configuration class rather than simply enumerate plaintext addresses.

2. Single-use smart contracts per victim. Pre-shutdown Inferno relied on a shared spender contract reused across affiliates and campaigns, which gave defenders a load-bearing on-chain detection signal — a single contract address could be flagged once and propagated to all wallet-vendor warning lists. Reloaded deploys a fresh smart contract per victim, used once and discarded. The defender-side detection signal at the spender-address level no longer exists at scale; each victim sees a unique contract address that has never been flagged. The detection requirement therefore migrates up from the address layer to the bytecode-similarity layer (does this newly-deployed contract match the bytecode signature of known drainer-class contracts?) and to the upstream-funder-graph layer (was this contract deployed by a wallet whose funder-graph clusters with known drainer infrastructure?). This is a discrete shift in detection requirement that warrants explicit T6 framing.

3. Proxy-based command-and-control obfuscation. Pre-shutdown Inferno's C2 attribution operated at the IP / domain layer; defenders could attribute campaigns to the C2 endpoint and propagate. Reloaded routes C2 communications through proxy systems that obfuscate the C2 endpoint behind layered proxies, defeating direct attribution to a specific server. Combined with the encrypted on-chain configuration (which prevents extracting the C2 endpoint from the on-chain artefacts), the proxy obfuscation layer makes operator-level attribution materially harder than during the pre-shutdown Inferno era.

The campaign's primary distribution surface in 2025 is impersonation of Collab.Land, the widely-used legitimate Discord-verification-bot used by most major Web3 communities for community-membership gating. Discord-server members invited to a "verification" flow are redirected to a phishing site hosting the drainer payload, which solicits standard setApprovalForAll / Permit2-class signatures against the victim's wallet. The Discord distribution surface is structurally significant because it routes through a trust-anchor (the Collab.Land bot) that members of Web3 communities have been explicitly trained to interact with as a routine verification step.

For OAK's T6 framing, the Reloaded campaign is the canonical 2025 worked example demonstrating that commercial drainer services can re-architect their on-chain footprint to defeat the standard 2023-era detection pipeline while reusing the same underlying smart-contract infrastructure deployed years earlier. The structural lesson is that operator-name retirement (November 2023 Telegram-announced shutdown) does not retire service-infrastructure (the September 2023 smart contracts are still operational in May 2025) and the operator can simultaneously re-architect the evasion layer (encrypted on-chain config, single-use contracts, proxy C2) while preserving the infrastructure layer.

Timeline (UTC)

When	Event	OAK ref
2023-09-09	Critical smart contracts deployed during pre-shutdown Inferno-branded operation; these contracts persist into the 2024-2025 Reloaded campaign per Check Point analysis	(infrastructure-persistence anchor)
2023-11-26	Inferno Drainer announces Telegram-side shutdown of branded operation (covered in `examples/2024-10-inferno-drainer-handover.md`)	T8.002 (operator-brand retirement; infrastructure persists)
2024-09 onward	Reloaded campaign begins active operation; encrypted on-chain configuration + single-use smart contracts + proxy-based C2 deployed	T6 evasion overlays operational
2024-10	Pre-shutdown spender-cluster addresses fully retired; affiliate base migrates to short-lifespan / frequent-rotation address scheme per Group-IB / Decrypt reporting	T6 (address-rotation evasion)
2025-01	Check Point Research first detects the Discord-CollabLand-impersonation phishing flow targeting members of a major Web3 community	(community detection)
2024-09 to 2025-03 (active reporting window)	Approximately 30,000+ unique victim wallets drained across 30+ blockchains; aggregate ~$9M loss; largest single-victim loss $761,000	(campaign aggregate)
2025-05	Check Point Research publishes "Return of the Crypto Inferno Drainer — Deep Dive into the Return of the Most Sophisticated Crypto Drainer"	forensic disclosure
2025-05 onward	Decrypt, Infosecurity Magazine, GBHackers, Cybersecuritynews, FullyCrypto, Wizcase, NCNOnline publish convergent reporting	(forensic record)
Continuing	Encrypted on-chain configuration class persists in active use; per-affiliate / per-operator attribution not public at v0.1 cutoff; campaign continues post-disclosure with adapted infrastructure	(attribution state)

What defenders observed

Encrypted on-chain configuration defeats plaintext-enumeration scraping pipelines. The pre-shutdown Inferno detection model assumed C2 endpoints, fee-collection addresses, and configuration parameters were enumerable on-chain in plaintext. Reloaded encrypts the configuration on-chain; the bytes are publicly visible but not interpretable without the runtime decryption key. The defender-side update is bytecode-pattern-recognition + decryption rather than plaintext-enumeration. Check Point's published methodology includes the decryption logic; defender pipelines need to consume the methodology and propagate to the broader detection ecosystem.
Single-use per-victim smart contracts defeat spender-address-blocklist propagation. The pre-shutdown Inferno detection model relied on shared spender contracts that defenders could flag once and propagate. Reloaded deploys fresh contracts per victim; each contract address is unique and never reused. Defender-side detection migrates to bytecode-similarity matching (the contract's bytecode is the same family even though the address differs) and to upstream-funder-graph clustering (the deployment-funding wallet clusters with known drainer infrastructure even when the deployed contract is fresh). Both are higher-effort detection signals than the pre-shutdown spender-blocklist approach.
Proxy-based C2 defeats IP / domain attribution. Pre-shutdown C2 attribution at the IP / domain level is no longer effective; the proxy layer routes communications through endpoints that obfuscate the actual C2 server. Defender-side attribution shifts to behavioural traffic analysis (does the proxy endpoint exhibit the traffic pattern of a drainer-class C2?) and to upstream proxy-provider cooperation. Check Point notes that the proxy obfuscation specifically prevents direct attribution; this is a calibrated defense-evasion outcome.
Discord + Collab.Land impersonation is a high-trust-anchor distribution surface. Discord servers for major Web3 communities use Collab.Land as the canonical wallet-verification bot for token-gated access. Members are explicitly trained to interact with Collab.Land's verification flow as a routine action. Impersonating Collab.Land routes the phishing flow through a high-trust-anchor surface that members are operationally trained not to be suspicious of. The defender-side counter operates at the Discord-server-layer (server-administrator-side verification of bot identity, allowlist of legitimate Collab.Land deployment addresses) and at the user-side (transaction-simulation surfaces in wallet extensions catching the eventual approve solicitation regardless of the routing trust-anchor).
Service-infrastructure persistence is empirically validated at the bytecode level. Check Point's analysis explicitly demonstrates that smart contracts deployed in September 2023 (during the pre-shutdown Inferno-branded operation) remain operational in the May 2025 Reloaded campaign. This is direct on-chain corroboration of the OAK-G02 thesis at the bytecode-fingerprint level — service infrastructure persists across operator-brand retirement events as a structural feature of the drainer-services category, not merely as a contingent observation.

What this example tells contributors writing future Technique pages

The Reloaded T6 evasion-overlay set is a discrete v0.x sub-Technique candidate. The combination of (a) encrypted on-chain configuration, (b) single-use smart contracts per victim, and (c) proxy-based C2 obfuscation defines a discrete attack class that warrants explicit naming in v0.x updates. The detection-signal layer (bytecode-pattern + funder-graph + behavioural-traffic) is materially different from the pre-shutdown Inferno detection model (spender-blocklist + plaintext-config-enumeration + IP-attribution) and warrants its own Mitigation enumeration.
Bytecode-similarity detection is the load-bearing v0.x detection-pipeline upgrade. Single-use smart contracts defeat address-blocklist propagation; bytecode-similarity matching against a known-malicious-bytecode-fingerprint-database is the v0.x detection-pipeline upgrade required. Future T4 / T6 worked examples in this category should record whether the campaign uses single-use vs shared spender contracts as a load-bearing structural feature, because the defender-side detection requirement differs materially.
Discord-bot impersonation is a discrete distribution-surface class. Collab.Land impersonation is structurally distinct from Twitter/X-account-compromise distribution (e.g., the Solana brand X-account compromise cohort covered in examples/2025-02-solana-x-account-compromise-cohort.md) and from search-ad-injection distribution (e.g., the Pudgy Penguins Google-Ads case in examples/2024-12-pudgy-penguins-google-ads-nft-drainer.md). Discord-bot impersonation exploits the trust-anchor that members are operationally trained to interact with; the defender-side counter operates at the Discord-server layer and the wallet-extension layer. Future T4 / T12 worked examples should record the distribution-surface class explicitly.
Service-infrastructure persistence is now empirically anchored at bytecode level. Check Point's September-2023-to-May-2025 contract-persistence finding is the load-bearing empirical anchor for the OAK-G02 service-infrastructure-persistence thesis. Future T8 / OAK-G02 worked examples should cross-reference this finding as the methodology anchor; the bytecode-level persistence is structurally distinct from operator-brand-name persistence and is the load-bearing attribution signal in the drainer-services category.

Public references

[checkpointinfernoreloaded2025] (proposed) — Check Point Research "Return of the Crypto Inferno Drainer — Deep Dive into the Return of the Most Sophisticated Crypto Drainer" (May 2025). https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/
[decryptinfernoreloaded2025] (proposed) — Decrypt reporting on the Inferno Drainer reloaded campaign ($9M / 30,000 victims / 6 months). https://decrypt.co/318561/inferno-drainer-malware-returns-stealing-9m-from-crypto-wallets-in-six-months
[infosecurityinfernoreloaded2025] (proposed) — Infosecurity Magazine reporting. https://www.infosecurity-magazine.com/news/inferno-drainer-returns-stealing/
[gbhackersinfernodiscord2025] (proposed) — GBHackers reporting on the Discord-impersonation phishing flow. https://gbhackers.com/new-advanced-phishing-attack-exploits-discord/
[cybersecuritynewsinferno2025] (proposed) — Cybersecuritynews reporting. https://cybersecuritynews.com/phishing-attack-abuses-discord/
[wizcaseinfernodiscord2025] (proposed) — Wizcase reporting on the campaign targeting 30,000 wallets via Discord bots. https://www.wizcase.com/news/crypto-scam-inferno-drainer-discord-phishing/
[scworldinfernoreloaded2025] (proposed) — SC World reporting on the increased sophistication. https://www.scworld.com/brief/inferno-drainer-reemerges-with-increased-sophistication
[slowmist2024report] — broader 2024 wallet-drainer ecosystem retrospective; aggregate ~$494M ecosystem total context.
[checkpoint2023drainers] — Check Point Research 2023 baseline reference; pre-shutdown Inferno-branded operation context.

Discussion

The Inferno Drainer Reloaded campaign is the canonical 2025 worked example for commercial-drainer-service defense-evasion re-architecture at infrastructure-persistence scale. The case complements examples/2024-10-inferno-drainer-handover.md (operator-handover service-level frame) by anchoring the post-handover evasion-overlay re-architecture with named-disclosure-date, named-forensic-provider attribution at v0.1.

The case is structurally significant for OAK's T6 coverage along three load-bearing axes:

The defense-evasion re-architecture is on-chain-observable but requires advanced detection. The encrypted on-chain configuration + single-use contracts + proxy C2 are all observable on-chain at the bytecode / artefact level, but defeat the standard 2023-era detection pipeline (plaintext-spender-enumeration + shared-contract-blocklist + IP-attribution). The defender-side update is materially in detection methodology rather than in detection visibility — the data is on-chain; the pipeline that consumes it must be re-architected.
Service-infrastructure persistence is empirically anchored at bytecode level. Check Point's September-2023-to-May-2025 contract-persistence finding is the empirical anchor for the OAK-G02 thesis. Operator-brand retirement (November 2023 Telegram-announced shutdown) does not retire service-infrastructure (the September 2023 smart contracts are still operational 18+ months later in May 2025). Future T8 / OAK-G02 worked examples should cross-reference this finding as the load-bearing empirical evidence.
Discord-bot impersonation is a discrete high-trust-anchor distribution surface. Collab.Land's role as the canonical Web3-community wallet-verification bot makes it a high-trust-anchor whose impersonation routes the phishing flow through a surface members are operationally trained not to be suspicious of. The defender-side counter operates at the Discord-server layer (server-administrator allowlist of legitimate Collab.Land deployment addresses) and at the wallet-extension layer (transaction-simulation catching the eventual approve solicitation). Future T4 / T12 worked examples should record the distribution-surface class explicitly because the defender-side counter differs materially across distribution surfaces.

For OAK's broader cohort coverage, Reloaded sits alongside examples/2024-12-pudgy-penguins-google-ads-nft-drainer.md (ad-network distribution surface) and the actors/OAK-G02-drainer-services.md actor page in establishing the structural matrix of drainer-services-category distribution surfaces and evasion overlays in the 2024-2025 cohort. The three together — operator handover (2023 → 2024), distribution-surface diversification (Discord, Google Ads, X-account compromise), evasion-overlay re-architecture (encrypted config, single-use contracts, proxy C2) — collectively span the load-bearing structural variations of the drainer-services category at v0.1.

Check Point Research's "Inferno Drainer Reloaded" disclosure is the canonical 2025 forensic-provider anchor for this category. The methodology — tracing malicious smart contracts, decrypting on-chain encrypted configurations, fully uncovering Discord phishing flows — defines the v0.x detection-pipeline upgrade required for defenders. Future T6 / T4 worked examples in this category should treat Check Point's methodology as the load-bearing reference; the pipeline upgrade is now publicly documented and the broader ecosystem (wallet vendors, exchange-side deposit screening, OFAC-tier compliance, browser extensions) needs to consume it.